VU#166125: Bisheng has authentication bypass vulnerabilities
Description
Bisheng, an open-source LLM application DevOps platform, contains three vulnerabilities: a legacy SSO endpoint that allows unauthenticated account takeover and administrative access; an IDOR vulnerability exposing cross-user workflow data to authenticated users; and a missing access control in the assistant service enabling credential abuse and data disclosure prior to version 2.5.0. Two of these vulnerabilities have been patched in versions 2.5.0 and 3.0.0 respectively, while the legacy SSO bypass remains unpatched. Manual mitigations are recommended until an official fix is available.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Bisheng suffers from three distinct vulnerabilities. CVE-2026-96679 is a legacy SSO bypass where the POST /user/sso endpoint issues JWTs without authentication or signature verification, auto-registers accounts, and grants super-administrator privileges if the username matches the admin or is the first user. CVE-2026-96681 is an IDOR vulnerability allowing authenticated users to access workflow DSL configurations of other accounts due to missing authorization checks on version retrieval endpoints. CVE-2026-100156 involves the assistant service accepting assistant identifiers without verifying ownership, enabling authenticated users to abuse AI inference resources and leak configured tools. The vendor has patched CVE-2026-96681 in version 3.0.0 and CVE-2026-100156 in version 2.5.0. The legacy SSO bypass (CVE-2026-96679) remains unpatched with no vendor response. CERT/CC recommends upgrading where patches exist and applying manual mitigations for the unpatched vulnerability.
Potential Impact
The legacy SSO vulnerability (CVE-2026-96679) allows unauthenticated attackers to bypass authentication, potentially gaining super-administrative control and full application compromise. The IDOR vulnerability (CVE-2026-96681) leads to unauthorized disclosure of sensitive workflow data across user accounts. The assistant service vulnerability (CVE-2026-100156) enables authenticated attackers to perform unauthorized AI inferences billed to other users and leak assistant configuration data. Together, these flaws risk full administrative takeover, data confidentiality breaches, and resource abuse.
Mitigation Recommendations
Two vulnerabilities have official patches: CVE-2026-100156 fixed in version 2.5.0 and CVE-2026-96681 fixed in version 3.0.0; upgrading to these versions is recommended. For the unpatched legacy SSO bypass (CVE-2026-96679), administrators should avoid setting BISHENG_PRO=true, disable or deprecate the legacy SSO endpoint, enforce global JWT validation, and restrict network access to the POST /user/sso endpoint to loopback or same-origin. These manual mitigations provide defense-in-depth until an official fix is released.
Technical Details
- Classification
- {"confidence":0.95,"severitySource":"heuristic","classifier":"rss-v2"}
- Article Source
- {"url":"https://kb.cert.org/vuls/id/166125","fetched":true,"fetchedAt":"2026-10-14T12:49:36.127Z","wordCount":746}
Threat ID: 6acf7a602cdf04f6567c80a3
Added to database: 10/14/2026, 12:49:36 UTC
Last enriched: 10/14/2026, 12:49:40 UTC
Last updated: 10/14/2026, 12:49:40 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.